{"action":"created","issue":{"url":"https://api.github.com/repos/cms-sw/cmssw/issues/21313","repository_url":"https://api.github.com/repos/cms-sw/cmssw","labels_url":"https://api.github.com/repos/cms-sw/cmssw/issues/21313/labels{/name}","comments_url":"https://api.github.com/repos/cms-sw/cmssw/issues/21313/comments","events_url":"https://api.github.com/repos/cms-sw/cmssw/issues/21313/events","html_url":"https://github.com/cms-sw/cmssw/issues/21313","id":274049622,"number":21313,"title":"stack-buffer-overflow, read of 4 bytes, TrackCleaner::isCompatible","user":{"login":"davidlt","id":197091,"avatar_url":"https://avatars3.githubusercontent.com/u/197091?v=4","gravatar_id":"","url":"https://api.github.com/users/davidlt","html_url":"https://github.com/davidlt","followers_url":"https://api.github.com/users/davidlt/followers","following_url":"https://api.github.com/users/davidlt/following{/other_user}","gists_url":"https://api.github.com/users/davidlt/gists{/gist_id}","starred_url":"https://api.github.com/users/davidlt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidlt/subscriptions","organizations_url":"https://api.github.com/users/davidlt/orgs","repos_url":"https://api.github.com/users/davidlt/repos","events_url":"https://api.github.com/users/davidlt/events{/privacy}","received_events_url":"https://api.github.com/users/davidlt/received_events","type":"User","site_admin":false},"labels":[{"id":53167770,"url":"https://api.github.com/repos/cms-sw/cmssw/labels/pending-signatures","name":"pending-signatures","color":"eb6420","default":false},{"id":52820010,"url":"https://api.github.com/repos/cms-sw/cmssw/labels/reconstruction-pending","name":"reconstruction-pending","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-11-15T06:35:12Z","updated_at":"2017-11-20T14:33:11Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"CMSSW: `CMSSW_10_0_ASAN_X_2017-11-12-1100`\r\nSCRAM_ARCH: `slc6_amd64_gcc700`\r\nWorkflow: `150.0`\r\nStep: `step3`\r\n\r\nDetailed report:\r\n```\r\n=================================================================\r\n==11614==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffebfb49d7c at pc 0x7f1e5a7456d2 bp 0x7ffebfb49d00 sp 0x7ffebfb49cf8\r\nREAD of size 4 at 0x7ffebfb49d7c thread T0\r\n    #0 0x7f1e5a7456d1 in TrackCleaner::isCompatible(DetId const&, DetId const&) const /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelLowPtUtilities/src/TrackCleaner.cc:112\r\n    #1 0x7f1e5a746081 in TrackCleaner::canBeMerged(std::vector<TrackingRecHit const*, std::allocator<TrackingRecHit const*> > const&, std::vector<TrackingRecHit const*, std::allocator<TrackingRecHit const*> > const&) const /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelLowPtUtilities/src/TrackCleaner.cc:149\r\n    #2 0x7f1e5a747895 in TrackCleaner::cleanTracks(std::vector<std::pair<reco::Track*, std::vector<TrackingRecHit const*, std::allocator<TrackingRecHit const*> > >, std::allocator<std::pair<reco::Track*, std::vector<TrackingRecHit const*, std::allocator<TrackingRecHit const*> > > > > const&) const /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelLowPtUtilities/src/TrackCleaner.cc:240\r\n    #3 0x7f1e5a597990 in PixelTrackCleanerWrapper::clean(std::vector<std::pair<reco::Track*, SeedingHitSet>, std::allocator<std::pair<reco::Track*, SeedingHitSet> > > const&) const /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelTrackFitting/interface/PixelTrackCleanerWrapper.h:31\r\n    #4 0x7f1e5a5952f2 in PixelTrackReconstruction::run(std::vector<std::pair<reco::Track*, SeedingHitSet>, std::allocator<std::pair<reco::Track*, SeedingHitSet> > >&, edm::Event&, edm::EventSetup const&) /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelTrackFitting/src/PixelTrackReconstruction.cc:103\r\n    #5 0x7f1e53782643 in PixelTrackProducer::produce(edm::Event&, edm::EventSetup const&) /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelTrackFitting/plugins/PixelTrackProducer.cc:50\r\n    #6 0x7f1e832ca633 in edm::stream::EDProducerAdaptorBase::doEvent(edm::EventPrincipal const&, edm::EventSetup const&, edm::ActivityRegistry*, edm::ModuleCallingContext const*) (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x6bc633)\r\n    #7 0x7f1e82ef598c in edm::WorkerT<edm::stream::EDProducerAdaptorBase>::implDo(edm::EventPrincipal const&, edm::EventSetup const&, edm::ModuleCallingContext const*) (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x2e798c)\r\n    #8 0x7f1e82d8343d in decltype ({parm#1}()) edm::convertException::wrap<bool edm::Worker::runModule<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::MyPrincipal const&, edm::EventSetup const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*)::{lambda()#1}>(bool edm::Worker::runModule<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::MyPrincipal const&, edm::EventSetup const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*)::{lambda()#1}) (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x17543d)\r\n    #9 0x7f1e82d838c2 in bool edm::Worker::runModule<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::MyPrincipal const&, edm::EventSetup const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*) (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x1758c2)\r\n    #10 0x7f1e82d8b3dc in std::__exception_ptr::exception_ptr edm::Worker::runModuleAfterAsyncPrefetch<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(std::__exception_ptr::exception_ptr const*, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::MyPrincipal const&, edm::EventSetup const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*) (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x17d3dc)\r\n    #11 0x7f1e82d8e2c9 in edm::Worker::RunModuleTask<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >::execute() (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x1802c9)\r\n    #12 0x7f1e8114c055 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) ../../src/tbb/custom_scheduler.h:509\r\n    #13 0x7f1e8308ddcf in edm::EventProcessor::readAndProcessEvents() (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x47fdcf)\r\n    #14 0x7f1e830bbc26 in edm::EventProcessor::runToCompletion() (/cvmfs/cms-ib.cern.ch/week0/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/lib/slc6_amd64_gcc700/libFWCoreFramework.so+0x4adc26)\r\n    #15 0x412f67 in main::{lambda()#1}::operator()() const (/cvmfs/cms-ib.cern.ch/nweek-02498/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/bin/slc6_amd64_gcc700/cmsRun+0x412f67)\r\n    #16 0x40d322 in main (/cvmfs/cms-ib.cern.ch/nweek-02498/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/bin/slc6_amd64_gcc700/cmsRun+0x40d322)\r\n    #17 0x326f01ed1c in __libc_start_main (/lib64/libc.so.6+0x326f01ed1c)\r\n    #18 0x40da88  (/cvmfs/cms-ib.cern.ch/nweek-02498/slc6_amd64_gcc700/cms/cmssw/CMSSW_10_0_ASAN_X_2017-11-12-1100/bin/slc6_amd64_gcc700/cmsRun+0x40da88)\r\n\r\nAddress 0x7ffebfb49d7c is located in stack of thread T0 at offset 44 in frame\r\n    #0 0x7f1e5a74535f in TrackCleaner::isCompatible(DetId const&, DetId const&) const /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelLowPtUtilities/src/TrackCleaner.cc:101\r\n\r\n  This frame has 1 object(s):\r\n    [32, 44) 'max' <== Memory access at offset 44 overflows this variable\r\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext\r\n      (longjmp and C++ exceptions *are* supported)\r\nSUMMARY: AddressSanitizer: stack-buffer-overflow /build/davidlt/CMSSW_10_0_ASAN_X_2017-11-12-1100/src/RecoPixelVertexing/PixelLowPtUtilities/src/TrackCleaner.cc:112 in TrackCleaner::isCompatible(DetId const&, DetId const&) const\r\nShadow bytes around the buggy address:\r\n  0x100057f61350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x100057f61360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x100057f61370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x100057f61380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x100057f61390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x100057f613a0: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00[04]\r\n  0x100057f613b0: f2 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00\r\n  0x100057f613c0: 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2\r\n  0x100057f613d0: 04 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2\r\n  0x100057f613e0: f8 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2\r\n  0x100057f613f0: f8 f2 f2 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07\r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==11614==ABORTING\r\n```\r\n\r\nThe problem is here:\r\nhttps://github.com/cms-sw/cmssw/blob/master/RecoPixelVertexing/PixelLowPtUtilities/src/TrackCleaner.cc#L112\r\n\r\n`max` only contains 3 elements, but `tTopo_->pxbLayer(i1)-1` produces 3, which is out-of-bounds.\r\n"},"comment":{"url":"https://api.github.com/repos/cms-sw/cmssw/issues/comments/345712693","html_url":"https://github.com/cms-sw/cmssw/issues/21313#issuecomment-345712693","issue_url":"https://api.github.com/repos/cms-sw/cmssw/issues/21313","id":345712693,"user":{"login":"davidlt","id":197091,"avatar_url":"https://avatars3.githubusercontent.com/u/197091?v=4","gravatar_id":"","url":"https://api.github.com/users/davidlt","html_url":"https://github.com/davidlt","followers_url":"https://api.github.com/users/davidlt/followers","following_url":"https://api.github.com/users/davidlt/following{/other_user}","gists_url":"https://api.github.com/users/davidlt/gists{/gist_id}","starred_url":"https://api.github.com/users/davidlt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidlt/subscriptions","organizations_url":"https://api.github.com/users/davidlt/orgs","repos_url":"https://api.github.com/users/davidlt/repos","events_url":"https://api.github.com/users/davidlt/events{/privacy}","received_events_url":"https://api.github.com/users/davidlt/received_events","type":"User","site_admin":false},"created_at":"2017-11-20T14:33:11Z","updated_at":"2017-11-20T14:33:11Z","author_association":"CONTRIBUTOR","body":"Could someone propose a pull request fixing it?"}}
{"actor":{"display_login":"davidlt"}}